CVE-2026-109278: ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in Wavelet-Denoise Operation
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocated memory when a required resource cannot be acquired. Attackers can repeatedly trigger wavelet-denoise processing under resource-constrained conditions to leak memory and degrade service availability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 6.9.13-57 - Upgrade
Upgrade
ImageMagickto a version that resolves this vulnerability.Fixed in 7.1.2-32
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using ImageMagick versions earlier than 6.9.13-57, or 7.x versions earlier than 7.1.2-32, are affected when they perform wavelet-denoise processing.
What does an attacker need to do to exploit the leak?
An attacker must be able to repeatedly trigger wavelet-denoise processing while the service is under resource-constrained conditions that prevent acquisition of a required resource. The impact is memory consumption that can degrade availability.
How can I reduce exposure if I cannot upgrade immediately?
Limit or disable untrusted wavelet-denoise processing where possible, and prevent repeated requests from driving the service into resource-constrained conditions. Monitor memory use and availability for workloads that invoke wavelet-denoise.